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RELIABILITY  ANALYSIS  OF  NETWORKS  CARRYING  CRITICAL  MISSION 

TRAFFIC 


1  Introduction 

This  report  addresses  network  reliability  issues  for  special-purpose  networks  which  are  used  ex¬ 
clusively  for  a  specified  information  transfer.  Such  networks  can  be  found  in  special  networks  for 
military  surveillance,  data  collection,  processing,  and  dissemination.  Such  special  networks  typ¬ 
ically  have  predetermined  traffic  requirements  for  critical  operations,  whereas  traffic  demands  in 
commercial  networks  in  general  are  random  and  up  to  the  activities  of  the  subscribers. 

In  analyzing  the  network  reliability,  the  network  is  typically  represented  by  graph  G  —  {V,E), 
where  V  denotes  a  set  of  nodes,  and  E  denotes  the  set  of  links.  Traditionally  defined  network  relia¬ 
bility  measures  (e.g.,  edge  connectivity,  node  connectivity,  cut  frequency  vector,  cohesion,  source- 
to-K-terminal  reliability,  etc.  [1])  are  concerned  with  disconnection  of  nodes.  For  example,  the 
reliability  is  measured  by  the  minimum  number  of  link  failures  that  disconnects  the  graph  (de¬ 
terministic,  worst-case  setting)  or  the  probability  that  the  network  is  disconnected  (probabilistic 
setting)  [1],  Such  network  reliability  measures  have  been  studied  extensively  in  the  past.  These 
existing  measures  are  meaningful  for  general,  commercial  networks  because  they  do  not  consider 
specific  traffic  demands  from  users. 

This  report  is  concerned  that  critical  network  operations  still  can  fail  even  if  network  connectivity 
is  preserved.  For  example,  a  certain  link  failure  can  keep  the  network  connected  but  disable  the 
critical  mission  that  the  network  supports.  In  defining  reliability  measures  for  special-purpose 
networks,  this  report  suggests  that  the  concern  be  the  ability  to  carry  the  critical  mission  rather  than 
connectivity.  Thus,  the  reliability  measures  are  to  be  defined  based  on  both  the  network  topology 
and  the  specific  traffic  demand  required  for  the  critical  mission. 


2  Reliability  Analysis 


2.1  Traffic  Accommodation 


In  defining  a  new  reliability  measure,  we  represent  the  network  by  a  directed  graph  G  —  (V,  E)  and 
link  capacity  cj  for  each  link  ej  €  E.  The  directed  graph  G  is  also  represented  by  the  |  V|  x  |£| 
node-arc  incidence  matrix  [2],  A  =  [atJ],  where 


+1 

-1 

0 


if  link  €j  leaves  node  i 
if  link  Cj  enters  node  i 
otherwise 
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We  denote  the  traffic  demand  by  a  set  of  numbers  fs,s  =  1 , 2,  ■  •  • ,  S  where  fs  represents  the  re¬ 
quired  data  rate  of  session  s.  Each  session  is  represented  by  an  ordered  pair  of  nodes;  i.e.,  source 
node  and  destination  node  of  the  traffic.  Given  the  network  topology  and  the  traffic  demand,  the 
natural  question  to  raise  is  whether  the  network  can  accommodate  all  total  traffic  demand.  Elabo¬ 
rating  further,  can  we  find  a  set  of  routes  for  each  session  so  that  the  sum  of  all  the  traffic  flow  in 
each  link  is  below  the  link  capacity?  If  yes,  we  say  that  the  network  is  accommodating  the  traffic . 


We  can  answer  the  question  of  whether  the  network  is  accommodating  the  traffic  demand  by  the 
following  formulation.  Denote  by  \E\ -dimensional  vector  the  flow  of  traffic  belonging  to  ses- 

sion  s.  The  j  —  th  component  of  this  vector  Xj  }  represents  the  flow  of  session  s  traffic  through  link 
j  G  E .  Then  the  conservation  of  flow  at  nodes  gives  the  following  constraint. 

Ax^  =  fsSs\  s  =  1,2, ■••,5 


where  is  a  |F|-dimensional  vector  such  that 


+1 

-1 

0 


if  node  i  is  the  source  of  session  s 
if  node  i  is  the  sink  of  session  5 
otherwise 


Also,  the  link  capacity  imposes  the  following  constraint: 

5 

E  x<f]  ^  ch  j  =  1>2,-”,|£| 

5  =  1 

Finding  feasible  flows  jbM  satisfying  these  constraints  or  proving  the  nonexistence  of  such  flows 
can  be  done  through  Linear  Programming  [2].  More  specifically,  we  can  add  augmented  variables 
y(s) ,  s  =  1, 2,  •  •  • ,  5  and  solve  the  following  Linear  Programming  problem: 

S  |V| 

minimize  EEr 

5=1  1=1 

subject  to  +  Iy ^  =  fsd^s\  s  —  1, 2,  •  •  *,  S 

S 

XAS)  -  ci’  j  = 

5=1 

>  o 


If  the  minimal  cost  of  this  problem  is  0,  the  values  of  the  minimizing  vectors  are  feasible  flows. 
If  the  minimal  value  is  positive,  the  network  is  not  accommodating  the  traffic.  The  Linear  Program¬ 
ming  can  be  efficiently  solved  by  the  Simplex  Algorithm  [2]  for  the  most  part.  If  computational 
efficiency  is  desired  for  the  worst  instance,  one  can  choose  an  interior  point  method  [3]. 
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Figure  1:  14-node  Ring-Star  Network 


2.2  Reliability  Analysis  Based  on  Traffic  Accommodation 

With  this  formulation  we  can  perform  a  wide  range  of  reliability  analysis  for  a  given  network  from 
the  standpoint  of  the  traffic  accommodation.  For  example,  we  can  analyze  the  vulnerability  of  the 
network  operation  to  a  certain  link  failure,  a  set  of  link  failures,  a  certain  node  failure,  etc. 

Example  1:  link  failure  in  14-node  ring-star  network 

Consider  the  ring-star  network  in  Figure  1.  This  example  is  motivated  by  14  regional  hubs  of  a 
Wide  Area  Network.  All  the  links  are  full-duplex.  Each  link  of  the  ring  has  an  identical  capacity  C, 
and  each  radial  link  has  capacity  SC.  Consider  uniform  traffic;  all  14  x  13  sessions  originating  from 
and  destined  to  distinct  nodes  have  an  identical  traffic  demand  (intensity,  rate)  f  =  C/S.  We  first 
discuss  that  this  network  can  accommodate  the  specified  traffic  demand.  Consider  a  routing  scheme 
that  routes  the  traffic  according  to  the  following  rule,  which  we  refer  to  as  “two-hops-in — ring”: 

•  For  a  session  whose  source  or  destination  is  the  center  node  (node  1),  the  traffic  is  made  to 
flow  through  the  radial  link  from  teh  source  to  the  destination.  (It  only  takes  one  hop.) 

•  For  a  session  whose  source  and  destination  are  both  ring  nodes  and  no  more  than  two  hops 
away  from  each  other  on  the  ring,  the  traffic  is  routed  through  the  shortest  path  on  the  ring. 


For  example,  for  a  session  whose  source  is  node  2  and  whose  destination  is  node  1 3,  the  traffic 
goes  through  nodes  2,  14,  13,  successively.  As  another  example,  for  a  session  whose  source 
is  node  2  and  whose  destination  is  node  3,  the  traffic  goes  from  source  node  2  to  destination 
node  3  through  one  link. 

•  For  a  session  whose  source  and  destination  are  both  ring  nodes  and  more  than  two  hops  away 
from  each  other  on  the  ring,  the  traffic  is  routed  through  the  radial  links.  For  example,  for 
a  session  whose  source  is  node  2  and  whose  destination  is  node  12,  the  traffic  goes  through 
nodes  2,  1,  12,  successively. 

In  this  example,  the  link  from  node  2  to  3  carries  traffic  belonging  to  Origin-Destination  pairs 
(sessions)  (2, 3),  (2, 4),  and  (14, 3),  each  with  load  /  =  <7/3.  Therefore,  the  load  on  this  link  is 
3/  =  C.  The  counting  of  routes  going  through  each  link  shows  that  the  load  of  each  ring  link 
is  3/  =  C,  and  the  load  of  each  radial  link  is  9/  =  3 C.  Thus,  the  routing  scheme  saturates  all 
the  links.  However,  traffic  through  each  link  does  not  exceed  the  capacity,  so  the  “two-hops-in- 
ring”  routing  results  in  a  feasible  flow.  Thus,  the  network  is  accommodating  the  traffic  demand. 
In  relation  to  reliability,  the  following  question  is  to  be  asked:  if  one  radial  link  or  a  ring  link  is 
down,  can  the  network  accommodate  the  traffic?  It  turns  out  that  a  link  failure  in  this  case  makes 
the  network  unable  to  accommodate  the  traffic.  Suppose  a  radial  link  incident  on  a  ring  node  i  fails. 
Then,  the  total  capacity  of  the  incident  directed  links  incoming  to  node  i  becomes  2 C.  The  total 
load  destined  for  node  i  is  13  X  C/3  >  2 C.  Therefore,  network  cannot  accommodate  the  traffic. 
Suppose  a  ring  link  incident  on  node  i  fails.  Then  the  total  capacity  of  the  incoming  links  incident 
on  node  i  is  4 C,  and  it  is  less  than  13  x  C/3.  Therefore,  again  the  network  cannot  accommodate 
the  traffic.  □ 

Example  2:  reduced  traffic  demand 

For  the  same  network  (illustrated  in  Figure  1),  we  now  consider  uniform  traffic  with  /  =  C/8.  The 
network  certainly  accommodates  this  traffic.  The  “two-hops-in-ring”  routing  scheme  specified  in 
the  previous  example  does  not  load  links  above  their  capacities.  The  load  is  3  ((7/8)  for  each  ring 
link,  and  9(<7/8)  for  each  radial  link.  Now  we  consider  link  failures.  If  one  ring  link  fails,  the 
network  still  accommodates  the  traffic.  For  each  path  that  includes  the  failed  link,  we  can  find  an 
alternate  route  through  the  two  radial  links.  For  example,  we  consider  the  failure  of  the  link  between 
node  2  and  node  14  in  Figure  2.  This  link  failure  disables  traffic  flow  of  the  Origin-Destination 
pairs  (2, 14),  (14, 2),  (2, 13),  (13, 2),  (3, 14),  (14, 3)  in  the  “two-hops-in-ring”  routing.  Consider 
the  restoration  routes  for  these  pairs  that  go  through  the  central  node  (node  1)  via  two  radial  links. 
For  example,  Origin-Destination  pair  (2, 14)  goes  through  nodes  2,1,14;  Origin-Destination  pair 
(2, 13)  goes  through  nodes  2,1,13;  etc.  These  restoration  routes  increase  the  load  of  the  radial  link 
between  node  1  and  node  2  by  2/  =  2C/8  in  each  direction.  The  restoration  routes  affect  the  radial 
link  between  node  1  and  node  14  in  the  same  way.  Therefore,  the  new  load  for  those  two  radial  links 
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Figure  2:  Failure  of  a  Ring  Link 


is  11(7/8,  which  is  less  than  the  capacity  3 C.  The  restoration  routes  also  increase  the  load  of  radial 
links  between  node  1  and  node  3  and  between  node  1  and  node  13  by  /  in  each  direction.  The  new 
load  of  these  links  is  10C/8.  On  the  other  hand,  the  links  between  node  2  and  node  3  and  between 
node  13  and  node  14  have  reduction  of  load  by  /  =  C/8  in  each  direction.  Therefore,  the  network 
still  accommodates  the  traffic  demand  after  the  failure  of  one  ring  link. 

Now  we  consider  the  failure  of  a  single  radial  link.  Figure  3  illustrates  the  failure  of  the  radial  link 
between  node  1  and  node  8.  It  is  suggested  that  the  restoration  route  be  through  the  adjacent  radial 
links;  routes  [1, 7, 8],  [1, 9, 8],  [8,  7, 1],  and  [8, 9, 1].  Total  9/  load  is  carried  through  each  radial  link 
in  each  direction  in  the  original  two-hops-in-ring  strategy.  We  split  the  load  equally  for  two-hop 
restoration  paths  in  both  sides.  Therefore,  for  the  two  radial  links  (the  link  between  node  1  and  node 

7  and  the  link  between  node  1  and  node  9)  and  the  two  ring  links  (the  link  between  node  7  and  node 

8  and  the  link  between  node  9  and  node  8)  have  increase  of  load  by  4.5 /  each.  The  new  load  of 
those  two  radial  links  is  9/  +  4.5/  =  13.5 /  =  13.5C/8  each,  and  it  is  less  than  the  capacity  3 C. 
The  new  load  of  the  two  ring  links  is  3/  +  4.5 /  —  7.5 /  =  7.5C/8  each,  and  it  is  less  than  the 
capacity  C.  Thus,  again  every  link  has  traffic  under  its  capacity,  and  the  network  accommodates  the 
traffic  demand  after  the  failure  of  one  ring  link.  □ 


Figure  3:  Failure  of  a  Radial  Link 


In  these  examples,  traffic  accommodation  in  the  case  of  various  link  failures  was  determined  through 
simple  observations.  In  more  general  (complex)  network  topologies  and  traffic  requirements,  the 
network  accommodation  can  be  determined  through  the  algorithm  presented  in  Subsection  2.1. 

As  for  a  node  failure,  if  the  failed  node  is  either  a  source  or  a  destination  of  any  traffic  session,  the 
traffic  cannot  be  accommodated.  If  the  node  is  neither  a  source  nor  a  destination,  one  can  define  a 
new  directed  graph  G'  that  is  obtained  by  removing  all  the  edges  incident  on  the  failed  node  and  the 
corresponding  node-arc  incidence  matrix  A'.  Then,  the  network  accommodation  can  be  determined 
by  using  the  algorithm  in  Subsection  2.1  with  matrix  A'. 

3  Reliability  Measures 

In  addition  to  studying  the  vulnerability  of  critical  mission  to  the  failure  of  particular  links  or  nodes, 
from  the  standpoint  of  traffic  accommodation  one  can  construct  a  wide  range  of  reliability  measures. 
As  examples,  this  report  defines  edge  accommodativeness,  disaccommodation frequency  vector ,  and 
probability  of  accommodation.  Edge  accommodativeness  is  similar  in  spirit  to  edge  connectivity 
[1  ].  Edge  accommodativeness  is  defined  as  the  minimum  cardinality  of  a  set  of  edges  (links)  whose 


removal  makes  the  network  not  accommodating  the  traffic.  Disaccommodation  frequency  vector 
is  a  modification  of  the  cut  frequency  vector  [1]  [4]  for  traffic  accommodation  criteria.  Denoting 
the  disaccommodation  frequency  vector  by  u  =  («i,  U2,  ■  ■  • ,  W|b|),  we  define  Uk  as  the  number  of 
edge  subsets  of  size  k  whose  removal  makes  the  network  not  accommodating  the  traffic.  When  the 
probabilities  of  node  and  link  failures  are  available,  one  can  define  the  probability  that  the  network 
can  accommodate  the  traffic. 
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